The Diffie–Hellman key agreement is an anonymous, non-authenticated key-agreement protocol.

learn more… | top users | synonyms (1)

6
votes
2answers
316 views

Is it safe to reuse ECDH asymmetric keys for authentication?

Alice, Bob, and Carol each generate ECDH keypairs. Alice and Bob establish a communication channel and negotiate an AliceBob secret. The question is: Is it safe for Alice and/or Bob to reuse their ...
6
votes
2answers
406 views

CDH problem and Square-DH problem

CDH problem roughly says that choose $U=g^u, V=g^v$ uniformly at random from cyclic group $G$, it's hard to compute $CDH(U,V)=g^{uv}$. Square-DH problem roughly says choose $U=g^u$ uniformly at ...
6
votes
1answer
481 views

Understanding Twist Security with respect to short Weierstrass curves

I'm trying to understand the "Invalid-curve attacks against ladders" section of SafeCurves Twist Security page and I have difficulties to apply it to short Weierstrass curves. That section claims ...
6
votes
1answer
108 views

How to exctract ECDH parameters from an OpenSSL-generated $G$?

I'm using ECDH for generating ECDH public parameters (p,a,b,G,n), I try to get this values using openssl ecparam -in cert.pem -text -noout For ...
6
votes
1answer
265 views

Difference between “ECDH with cofactor key” and “ECDH without cofactor key”?

I need to use “ECDH with a cofactor key” for generating symmetric key. I have a fair idea on how ECDH works, but I don’t understand the cofactor part. What is the difference between ”ECDH with a co-...
6
votes
2answers
1k views

Vulnerabilities if encrypting the same data with 2 different keys

Let's say that Alice and Bob complete a key exchange and then Alice uses that key k1 to encrypt a 256-bit key kaes1 and sends it ...
6
votes
1answer
347 views

Why use variable p, q, g for Diffie-Hellman?

In the book Cryptographic Engineering, it is said that fixing p, q, g for a key negotiation protocol based on DH is a bad idea (page 228 1st ed). But allowing for flexible p, q and g requires a lot ...
5
votes
4answers
3k views

What is the relation between Discrete Log, Computational Diffie-Hellman and Decisional Diffie-Hellman?

How are the three problems Discrete Logarithm, Computational Diffie-Hellman and Decisional Diffie-Hellman related? From my understanding, since the Discrete Log (DL) Problem is considered hard, then ...
5
votes
2answers
4k views

How large should a Diffie-Hellman p be?

In a Diffie-Hellman exchange, the parties need to agree on a prime p and a base g in order to continue. Assuming some ...
5
votes
3answers
242 views

Is the $\ell$-Diffie Hellman Inversion easy when g is known?

From here they define the $\ell$-Diffie Hellman inversion problem as: Given $g^{a},g^{a^2}\ldots,g^{a^{\ell}} \in G$, compute $g^{a^{-1}}$ Would this problem become easy if the generator $g$ is ...
5
votes
2answers
8k views

AES encryption using a Diffie-Hellman key exchange

I have two systems which need to encrypt their communication by AES-128. The key for the AES encryption should be exchanged with the Diffie-Hellman (DH) algorithm. Now, I've read about DH and got a ...
5
votes
4answers
6k views

Diffie-Hellman and man-in-the-middle attacks

See here for the man-in-the-middle attack on Diffie-Hellman that I'm concerned about: What is Diffie-Hellman? How do we combat this? I have two questions: Is one solution for both Alice and Bob ...
5
votes
2answers
107 views

Where did Martin Hellman acknowledge Ralph Merkle's contribution to public-key cryptography?

I am trying to find the article to reference when discussing the Diffie-Hellman key exchange. According to Wikipedia Hellman said that The system...has since become known as Diffie–Hellman key ...
5
votes
1answer
89 views

Do low-entropy fingerprints actually make any sense?

I'm thinking of ZRTP and OTR in particular here. From my understanding, after a Diffie-Hellman session is initiated, the shared secret is then hashed into a 4-digit number, which the two parties can ...
5
votes
1answer
2k views

Why elgamal is still discussed

As I understand, if two users have a shared key, it is possible to encrypt a message using symmetric key encryption. So when a secret key is shared through Diffie-Hellman asymmetric key exchange, it ...
5
votes
1answer
375 views

Why are the random exponents so much bigger in the Socialist Millionaire protocol versus Diffie-Hellman key exchange?

Section 8, Security considerations, of RFC3526, which defines groups used for Diffie-Hellman has a table recommending some random exponent sizes. In particular, it says: The strength of a key ...
5
votes
2answers
208 views

Why does a non-prime DH modulus creates a “NOBUS” backdoor

can't we do a nobus backdoor with DH modulus prime? Some have argued that with a prime modulus you can just get the order by doing p-1 and then factor it, thus it is easy to reverse. I argue that this ...
5
votes
1answer
279 views

Side-channel attacks against ECDH for Weierstrass normal form curves

I hear a lot about why Montgomery curves are used in ECC, and one reason is that the same algorithm can be used to do both point addition and doubling (this is not true for the Weierstrass normal form)...
5
votes
1answer
2k views

Explanation of the Decision Diffie Hellman (DDH) problem.

I'm extremely new to crypto, and very much inexperienced. Lately I've been reading about the Diffie-Hellman key-exchange methods, and specifically about the computational diffie-hellman assumption vs. ...
5
votes
1answer
143 views

Discovering private exponent from public key

I'm going to assume this isn't possible, but I have to ask because I'm trying to fundamentally understand what I've thus far been trying to implement by following an RFC. SRP-6a starts off with ...
5
votes
1answer
167 views

Condensed ElGamal + AES

In normal ElGamal encryption, the encrypted message is a pair (gb, gabM) - that is, the actual "encryption" is simply multiplication by the shared secret ...
5
votes
1answer
2k views

Trouble with diffie-hellman groups

Is anyone able to point me towards a known-to-be-good diffie-hellman group? I currently use group 24 (RFC5114, 2048-bit MODP Group with 256-bit Prime Order Subgroup). It came to me that this group is ...
5
votes
1answer
188 views

Is there a group of prime order which could fit the CT-Computational Diffie-Hellman assumption?

I'm trying to choose a group that is hard under the Chosen-Target Computational Diffie-Hellman assumption, according to the definition in this paper, in order to implement the oblivious transfer ...
5
votes
1answer
400 views

Small subgroup confinement attack on Diffie-Hellman

I am trying to understand the small subgroup confinement attack on the Diffie-Hellman algorithm. I will present the attack and try to explain why it works. Small subgroup confinement attack on the ...
4
votes
3answers
218 views

After a diffie hellman key exchange, what is the common secret used for?

What is the common secret that is established used for? What types of interactions are now possible?
4
votes
2answers
315 views

Should I bother implementing DH + AES, or leave it to a library like Crypto++

I'm making a C++ back end for an application that'll heavily rely on AES-256 and DH. Should I trust third party libraries, or spend (lots of) time to learn about cryptographic implementation and write ...
4
votes
2answers
3k views

How to find generator $g$ in a cyclic group?

As generator $g$ is used in DH how do you find a combination of prime $p$ and $g$? eg: if we choose $p=23$ and its generator is $7$ (given in the book) how do we find the generator?
4
votes
1answer
614 views

Why must curve25519 shared secret be hashed?

When using the curve25519 DH function, D.J. Bernstein recommends hashing the shared secret before using it as a session key for a symmetric block cipher. Why is that? Hashing won't increase the ...
4
votes
1answer
227 views

Given $g^a, g^b, g^c, g^{1/b}$, is it hard to distinguish $e(g, g)^{abc}$ from a random value?

where $g$ is a group element in bilinear group $\mathbb{G}$. I understand it is very similar to the conventional DBDH problem, but $g^{1/b}$ is also known, possibly making it easier? Does anyone know ...
4
votes
2answers
2k views

TLS/SSL's usage of Non-Ephemeral DH vs DHE

These questions revolve around DH and ECDH vs DHE and ECDHE. Specifically within the context of TLS/SSL. There are three ...
4
votes
2answers
461 views

Does SRP reduce to DH key exchange when shared password is not secret?

I can find JavaScript implementations of SRP (Secure Remote Password protocol), but nothing that inspires confidence for Diffie-Hellmen key exchange. I also have a separate need for SRP later. I ...
4
votes
1answer
728 views

Is it feasible to break Diffie-Hellman key exchange when the implementation uses a poor-quality PRNG?

I've come across an implementation of DH in Java that uses the Random class to generate the secret integer value $a$, as shown in in Wikipedia's description of the ...
4
votes
3answers
560 views

Is it secure to use Diffie-Hellman key agreement to generate a nonce?

I have a system, using AES, in one of the modes that uses a nonce and authentication. We have a pre-shared key, and to agree about initial nonce we could use Diffie-Hellman, using the resulting ...
4
votes
1answer
410 views

EC ElGamal versus static+ephemeral ECDH

A client application needs to encrypt a UDP datagram for a server with known EC public key $P$. Performing a full ECDH key exchange would defeat the benefit of using UDP as a connectionless protocol. ...
4
votes
1answer
238 views

How can we determine if two discrete logarithms are equal?

Let $p$ be a prime number, and let $g_{1},g_{2},...,g_{n}$ be $n$ generator of $Z^{*}_{p}$. We have a list $y_{1},y_{2},\dotsc,y_{n}$ of elements in $Z^{*}_{p}$ such that for every $i\in \lbrace1,2,\...
4
votes
3answers
110 views

Is this Diffie-Hellman key exchange variant vulnerable to man-in-the-middle attacks?

As we all know, the Diffie-Hellman key exchange protocol without authentication is vulnerable to a man-in-the-middle attack. And if we use STS(Station-to-Station protocol) instead, it would be secure. ...
4
votes
1answer
585 views

Why use Needham-Schroeder if we have Diffie-Hellman?

If we want to establish secret symmetric key between two entities, why use Needham-Schroeder if we have Diffie-Hellman? With DH we don't need to have any trusted party, so what's the point of NS?
4
votes
1answer
642 views

some of my confusions about DDH assumption

The wiki defines the decisional Diffie–Hellman assumption as follows: Decisional Diffie–Hellman assumption Consider a (multiplicative) cyclic group $G$ of order $q$, and with generator $g$. The DDH ...
4
votes
2answers
308 views

Why does the modulus of Diffie–Hellman need to be a prime?

I read a lot about Diffie-Hellman, but there is one thing I dont understand: why does the modulus p need to be a prime? What if it would not be a prime?
4
votes
1answer
362 views

Does Identity-Based Encryption actually solve any problem?

Identity based encryption schemes [*] seem to have great potential in high-latency Delay-Tolerant and mobile, ad-hoc networks since they apparently seem to avoid the need for key negotiation and ...
4
votes
2answers
107 views

If we should not reuse primes in DH, shouldn't we not reuse ECDH elliptic curve properties?

An article How is NSA breaking so much crypto? describes NSA's methods for breaking encryption. If a client and server are speaking Diffie-Hellman, they first need to agree on a large prime number ...
4
votes
1answer
58 views

State level “Weak Diffie-Hellman” working for SRP too?

I've read about the "Weak Diffie-Hellman" attack (paper, website), where a resourceful entity like a state can pre-compute values for known primes to aid solving the discrete logarithm problem for ...
4
votes
1answer
143 views

ECDH and ECDSA in PGP with known public key

How are used ECDH and ECDSA in combination with public key ? Usually these methods are used for establish a secret themselves, ...
4
votes
1answer
157 views

Hashing a Diffie-Hellman result

In many implementations, the result of the Diffie-Hellman algorithm is hashed. I read that: Hashing the shared secret point prevents an attacker from gaining more information about the EC private ...
4
votes
2answers
5k views

Diffie-Hellman Key Exchange with Authentication: Man-in-the-Middle query

I have been reading up on MiTM attacks, and the prevention of them using public key certificates. Recently I learnt about Diffie-Hellman Key Exchange with Authentication, and how it uses signed ...
4
votes
2answers
691 views

Diffie-Hellman key agreement with both Server Authentication and Perfect Forward Secrecy

I am trying to find the protocol with the least overhead, which still meets the following requirements: Server Authentication of server identity to client. The client has an authentic copy of the ...
4
votes
1answer
163 views

Safety of a pre-keyed DH-Key Exchange

Asuming this scenario: Bob and Alice each have the public key of the other party for a D-H function and want to exchange data. Now, if they each generate their shared secret, is it safe to assume ...
4
votes
1answer
83 views

Diffie-Hellman: *assumed* largest prime factor of order of $g$?

I've read in several places: some of my confusions about DDH assumption - comment by Thomas Pornin on his own post Is there a key length definition for DH or DHE? - the answer by Tom Leek that ...
4
votes
1answer
123 views

Hardness of CDH in different groups

What is the difference of the CDH problem in different groups? In particular, given a group $\mathbb{G}_1$ of order $q$ that is a subgroup of $\mathbb{Z}_q^*$, $q$ prime, and another group $\mathbb{G}...
4
votes
2answers
576 views

Verilog simulation & synthesis of Diffie-Hellman key exchange

Is there any freely available verilog implementaion of Diffie-Hellman key exchange? I couldn't find anything using google. So, assuming its not there I started implementing on my own. The code is ...